Object Lock

Prevent objects in a Stook Bucket from being deleted until a configured retention period expires.

Configure Object Lock to protect objects in a Stook Bucket from deletion for a defined retention period.

Object Lock applies retention to objects written after the feature is enabled. It can be used for data that must be retained for a fixed period, such as backups, audit logs, or records subject to retention requirements.

Object Lock cannot be disabled after it is enabled for a Stook Bucket. Review the retention period before saving the configuration.

For complete request parameters, response schemas, and error responses, see Bucket Settings API.

How Object Lock Works

Object Lock protects each object for the configured Retention period, starting when the object is written.

The following behavior applies:

• Objects cannot normally be deleted before their retention period expires.

• After the retention period expires, objects can be deleted normally.

• Object Lock applies only to objects written after it is enabled.

• Objects already stored in the Stook Bucket are not protected retroactively.

• Changing the retention period affects only objects written after the change.

• Existing objects retain the retention period assigned when they were written.

Object Lock uses governance mode. In governance mode, a request that explicitly bypasses retention can delete a protected object version before its retention period expires if the access key has permission to bypass the retention.

The master key and access keys with All S3 Actions have this permission. Access keys limited to specific actions do not.

Requirements

Before enabling Object Lock:

• Set Versioning to On.

• Select a retention period between 1 and 365 days.

While Object Lock is enabled, Versioning cannot be suspended.

Configure Object Lock

1

Enable Versioning

If Versioning is not already enabled, set Versioning to On and save the configuration.

2

Open Object Lock

On the Bucket configuration page, select Object lock.

3

Enable Object Lock

Turn on Enabled.

4

Set the retention period

Enter the Retention period in days.

The supported range is 1 to 365 days.

5

Save the configuration

Select Save Changes.

Configuration Fields

Field	Description	Default
Enabled	Protects objects written after Object Lock is enabled. Object Lock cannot be disabled after activation.	Off
Retention period	Number of days each new object is protected after it is written. Supported range: 1–365 days.	—

For a retention period longer than 365 days, contact [e-mail].

Change the Retention Period

You can change the configured retention period after Object Lock is enabled.

The new retention period applies only to objects written after the change. Objects already stored retain the retention period assigned when they were written.

For example, changing the retention period from 30 days to 90 days does not extend the retention period of objects that were previously written with a 30-day retention period.

Delete a Stook Bucket with Object Lock

A Stook Bucket can be deleted only when it is empty, including all object versions and delete markers.

Objects that are still within their retention period cannot normally be deleted. Therefore, a bucket protected by Object Lock can be emptied only as the retention periods of its objects expire.

To empty the Stook Bucket:

1. Wait for the applicable retention periods to expire, then delete the objects and their versions.

2. Configure a lifecycle rule with an expiration period longer than the Object Lock retention period so that objects can be removed automatically after their retention periods expire. See Lifecycle Rules.

3. Contact Medianova Support if data must be removed before its retention period expires.

Configure Object Lock with the API

Use the bucket settings endpoint to enable Object Lock:

PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings

Send:

{
  "object_lock_enabled": true,
  "object_lock_days": 90
}

The request enables Object Lock and configures a 90-day retention period for new objects.

Object Lock cannot be disabled after it has been enabled.

Troubleshooting

Object Lock requires Versioning

Set Versioning to On and save the configuration before enabling Object Lock.

A retention period is required

Enter a Retention period between 1 and 365 days.

The retention period exceeds the supported maximum

The standard supported retention period is up to 365 days.

Enter a value of 365 days or less. For a longer retention period, contact [e-mail].

Object Lock cannot be disabled

Object Lock cannot be switched off after it has been enabled for the Stook Bucket.

Objects already stored with retention protection keep their assigned retention periods until they expire.

Versioning cannot be suspended

Versioning must remain On while Object Lock is enabled.

Deleting an object version returns AccessDenied

The object version may still be within its retention period.

Wait until the retention period expires before deleting the version.

Related Topics

• Bucket Configuration

• Versioning

• MFA Delete

• Manage Access Keys